diff --git a/ChangeLog b/ChangeLog
index 34728a7301..df3e8a2189 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Fri Jun 20 05:26:27 2014  Koichi Sasada  <ko1@atdot.net>
+
+	* vm_eval.c (rb_catch_protect): fix same problem of [Bug #9961].
+
+	* vm_eval.c (rb_iterate): ditto.
+
 Thu Jun 19 21:41:30 2014  Koichi Sasada  <ko1@atdot.net>
 
 	* vm.c (rb_vm_rewind_cfp): add new function to rewind specified cfp
diff --git a/vm_eval.c b/vm_eval.c
index 5d05952bcf..b53f9bc0f1 100644
--- a/vm_eval.c
+++ b/vm_eval.c
@@ -1104,10 +1104,11 @@ rb_iterate(VALUE (* it_proc) (VALUE), VALUE data1,
 	    VALUE *cep = cfp->ep;
 
 	    if (cep == escape_ep) {
+		rb_vm_rewind_cfp(th, cfp);
+
 		state = 0;
 		th->state = 0;
 		th->errinfo = Qnil;
-		th->cfp = cfp;
 		goto iter_retry;
 	    }
 	}
@@ -1863,7 +1864,7 @@ rb_catch_protect(VALUE t, rb_block_call_func *func, VALUE data, int *stateptr)
 	val = (*func)(tag, data, 1, (const VALUE *)&tag, Qnil);
     }
     else if (state == TAG_THROW && RNODE(th->errinfo)->u1.value == tag) {
-	th->cfp = saved_cfp;
+	rb_vm_rewind_cfp(th, saved_cfp);
 	val = th->tag->retval;
 	th->errinfo = Qnil;
 	state = 0;